Computer Use MCP denies Chrome approval after TCC reset and app restart

Bug Report: Computer Use MCP denies Chrome approval after TCC reset and app restart

Summary

Computer Use in Codex App consistently fails before interacting with Google Chrome:

Computer Use approval denied via MCP elicitation for app 'com.google.Chrome'.

This started suddenly around 2026-04-22/2026-04-23. The same Computer Use flow reportedly worked a few days earlier. Restarting Codex completely multiple times and resetting macOS TCC permissions did not resolve it.

Environment

• macOS: 15.6.1 (Build 24G90)
• Codex App bundle id: com.openai.codex
• Codex App version: 26.417.41555
• Codex App build: 1858
• Computer Use helper bundle id: com.openai.sky.CUAService
• Computer Use helper version: 1.0
• Computer Use helper build: 755
• Codex CLI: codex-cli 0.122.0
• oh-my-codex: v0.14.2
• Node.js: v22.19.0
• Platform: darwin arm64
• Target app: Google Chrome, bundle id com.google.Chrome

Reproduction Steps

1. Start Codex App.
2. Ensure Google Chrome is open.
3. Trigger Computer Use from Codex against Google Chrome, for example:

get_app_state({"app":"Google Chrome"})

1. Observe the failure:

Computer Use approval denied via MCP elicitation for app 'com.google.Chrome'.

Expected Behavior

Computer Use should request or reuse the proper permission and return Chrome window state/screenshot/accessibility tree, or show a user-actionable permission prompt.

Actual Behavior

Computer Use immediately returns:

Computer Use approval denied via MCP elicitation for app 'com.google.Chrome'.

No usable Chrome state is returned. Repeating the call produces the same failure.

Troubleshooting Already Tried

The user already fully quit and relaunched Codex App multiple times.

TCC reset was run successfully for both Codex App and the Computer Use helper:

tccutil reset Accessibility com.openai.codex
tccutil reset AppleEvents com.openai.codex
tccutil reset ScreenCapture com.openai.codex
tccutil reset Accessibility com.openai.sky.CUAService
tccutil reset AppleEvents com.openai.sky.CUAService
tccutil reset ScreenCapture com.openai.sky.CUAService

All commands returned success:

Successfully reset Accessibility approval status for com.openai.codex
Successfully reset Accessibility approval status for com.openai.sky.CUAService
Successfully reset AppleEvents approval status for com.openai.codex
Successfully reset AppleEvents approval status for com.openai.sky.CUAService
Successfully reset ScreenCapture approval status for com.openai.codex
Successfully reset ScreenCapture approval status for com.openai.sky.CUAService

After the reset and multiple Codex restarts, Computer Use still returned the same error.

Important Diagnostic Detail

Direct AppleEvents from the shell can still query Chrome successfully:

osascript -e 'tell application "Google Chrome" to get URL of active tab of front window'

Result:

http://localhost:7357/

This suggests Chrome automation is not globally blocked at the OS level. The failure appears specific to the Codex Computer Use MCP approval/elicitation path or the com.openai.sky.CUAService helper approval flow.

Process State Observed

Codex App and Computer Use helper were running:

/Applications/Codex.app/Contents/MacOS/Codex
/Applications/Codex.app/Contents/Resources/codex app-server --analytics-default-enabled
./Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient mcp

Impact

Computer Use is unusable for Chrome-based runtime smoke tests. This blocks browser-based validation from Codex App even though ordinary shell-level AppleEvents to Chrome still work.

Request

Please investigate whether:

1. Computer Use MCP app approval/elicitation state can get stuck in a denied state independent of macOS TCC.
2. com.openai.sky.CUAService needs additional reset/permission handling after Codex App updates.
3. The error should surface a user-actionable recovery step instead of just approval denied via MCP elicitation.

If there is an internal state file/cache that stores the denied elicitation result, please provide the supported way to reset it.